> For the complete documentation index, see [llms.txt](https://apidocs.arionbanki.is/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://apidocs.arionbanki.is/b2b-2013-schema/b2b-services/b2b-setting-up-a-authentication-and-certificates.md). # B2B Setting up a Authentication and Certificates ![](https://2818695535-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1H6XBw80lUfS2N0XzK27%2Fuploads%2FusEKAPJJvp3QInlOlIBO%2F0.png?alt=media) [B2B.is](https://b2b.is) **Introduction** B2B is a collection of web services for people wishing to conduct banking transactions online and to gain a good overview of their personal finances. All main banking transactions can be performed using Arion Bank’s B2B services, directly from the book-keeping system at any time. B2B is a communications tool for corporate book-keeping systems which enables the exchange of information to and from the Bank. It is used almost entirely in the book-keeping system without involving the online bank. Implementing B2B will shorten work processes and bring greater efficiency to the book-keeping process. It saves time and helps eliminate errors. Only one system is used, i.e. your company’s book-keeping system and this reduces the risk of errors. B2B provides a real-time view of book-keeping, thus better enabling informed decision-making. Please contact Corporate Banking at Arion Bank for further information, ### B2B web services B2B web services have a defined WCF endpoint with a Mutual Authentication security model. In addition the web services specified in the Icelandic Mutual Banking Scheme have defined WSE 2.0 endpoints to support backward compatibility. A username token is sent in which contains a user name, password and certificate. Information passing between the book-keeping system and the Bank is encrypted over HTTPS which ensures secure communications. In order to use WCF B2B web services the following steps must be followed: 1. Apply for a soft certificate (isl. Búnaðarskilríki) from the firm Auðkenni (). 2. Set up soft certificate and certification path. 3. Set up public certificate for Arion Bank. 4. Program calls to B2B web services, in the book-keeping system 5. Allow the book-keeping system to use the private key of the soft certificate 6. Each user logs into B2B and is approved/activated by Corporate Banking at Arion Bank. This manual contains information on how certificates are set up and how users identify themselves in B2B services. You can download C# .Net sample code from ### Access management B2B web services use Web Service Security (WSS) to send username token which contain a user name and password provided by Arion Bank and communications are signed using eID. The B2B services trust certificates from the firm Auðkenni hf. The security model in the services is Mutual Authentication. The Bank’s signature certificate is used to identify the Bank to users of the service. Certificates are also needed to identify users of the service to the Bank. There are two possibilities. * Soft certificate\ Soft certificate is a company’s electronic certificate, which is set up in its computer system. If this type of certificate is used, the user does not need to enter a PIN number when the certificate is used as the book-keeping system automatically finds the private key of the certificate. You can download example codes for C# .Net which shows how this done on . * Work certificate\ Work certificate is a card, which companies provide to their employees. The certificate is for individual but also contains the company’s ID number (isl. Kennitala). The card needs to be in the card reader of the user’s computer and the employee needs to enter a 4 digit PIN number every time the certificate is used to sign something. Companies receive both soft certificates and work certificates from Auðkenni, see [www.skilriki.is](http://www.skilriki.is/). The correct certification path for certificates needs to be in place for the certificates to work. The root at Auðkenni is called “Audkennisrot”. Certification paths can be obtained from Auðkenni where you can also find instructions on setting up soft certificates. For work certificates the user needs to have Nexus Personal software installed on their computer. This software, and instructions on how to install it, is available from Auðkenni. When work certificates are used for the first time the user will be asked whether they want to install the certification path of the Iceland root, which can be found on the card. If the user answers with yes, the certification path will be installed on the computer. B2B web services sign all outgoing messages. If WSE technology is used, the public part of the Bank’s certificate does not need to be installed at the company using the B2B web services. If WCF technology is used more stringent requirements on security are made and the computer calling the B2B services needs to have access to the public part of the Bank’s certificate. ### Installation of soft certificate ### Applying for certificate at Auðkenni You apply for a soft certificate from the firm Auðkenni hf (). In the application process a **private key** is installed in the computer on which the application was made. The technician in the application process receives an e-mail with a URL at Auðkenni, where they can obtain a public key certificate signed by the intermediate certificate "Traustur búnaður". The technician installs the public key in the same computer as used in the application process (the private key is on it) and the certificate is ready to be used on that computer. Note that this process may change at Auðkenni and it is therefore recommended that you follow the application process and the installation instructions from Auðkenni, when installing the certificate and the certification path. ### Exporting soft certificate If you need to use the soft certificate on other computers than the one where the application was made, the certificate needs to be exported. 1\. The first step is to open a certificate store, see section “Opening a certificate store” 2\. Select a certificate which is to be exported and select "All tasks" - "Export" and click "Next"
3\. Choose to export the private key.
4\. Choose to include the certification path.
5\. The file must be locked by using a password to protect the private key.
6\. Specify the name of the file you want to export.
### Importing a soft certificate Below are the instructions on how to import certificates into the certificate store on one computer. If the book-keeping system contacts an intermediate service responsible for sending the message and signing it, it is sufficient that the certificate is imported to the computer on which the intermediate service is installed. If, however, the book-keeping system is installed in multiple computers and each terminal is sending and signing messages, the certificate needs to be imported into every terminal. In such cases the system administrator can establish a group policy to manage importing certificates. 1\. The first step is to open a certificate store, see section “Opening a certificate store”
The root certificate “Audkennisrot” should be under Local Computer – Trusted Root Certificate Authorities (if the certificate is not in place, instructions can be found here )
*The intermediate certificates should be under Local Computer - Intermediate Certification Authorities* The location of the certificate used for signing is the responsibility of the systems administrator. The examples in this document use Local Computer – Personal 2\. In order to import a certificate into a certificate store you right click on the folder where you want to import the certificate and choose “All tasks" - “Import” and then click on “Next”
2\. Choose the file you want and then click on "Next"
3\. Now enter the password which was used when the certificate was exported, see “Exporting soft certificate”
4\. Specify a location for the certificate/certification path
5\. Complete import
### Grant rights for private key of soft certificate You have to grant the system or service using soft certificate access to its private key. In this case it is most often the book-keeping system or intermediate service which calls for B2B web services. In the case of a web/intermediate service, the user behind the Application Pool for the website must have reading access to the private key of the certificate. In most cases this is IIS\_IUSRS. For window systems it is usually the operating system user. The first step is to open a certificate store, see section “Opening a certificate store”. 1\. Choose the certificate, right click and choose All Tasks -> Manage PrivateKeys
2\. Give the system user read permission.
### Installing public key certificate for Arion Bank The security model in the services with WCF endpoints is Mutual Authentication. The Bank’s signature certificate is used to identify the Bank to users of the service. At you can download .Net C# code samples, where the public certificate is fetched automatically every time the B2B service is called. The project is called IsIT.B2B.ClaimServiceTest. There is also a code sample IsIT.B2B.PublicCertDownloader which fetches the Bank’s public key certificate. This code is also available as an exe file which can be used to fetch the Bank’s public key certificate. The public key certificate can be saved in a file (\*.cer), stored on a database or certificate store. That way you can avoid having to fetch it every time B2B service is called. However, problems occur when the Bank’s certificate expires and is renewed, which happens once a year. You would then need to get a new public key certificate and update it in the book-keeping system. ### Logging in to B2B In order to connect to B2B you need a user name and password from Arion Bank and the message needs to be signed with a certificate. If using a certificate that has not been used before when communicating with the Bank with this particular user name, the certificate needs to be activated by the Bank. Before the certificate can be activated, it is necessary to call B2B service once, e.g. by requesting an exchange rate. The service will generate an error with the error code 1000. After that an employee of Corporate Banking can activate the certificate for that user. Note that the user first needs to try to make a connection and get an error message before the Bank can approve the use of the certificate. This only applies to the first time the user connects to B2B and not when renewing a certificate. ### Opening a certificate store Run Microsoft Management Consol (MMC.exe) Start → Run → MMC Choose File → Add Remove Snap-in
Choose Certificates in Available snap-ins and click on “Add”.
Choose Computer account and click on “Next”
Choose Personal or Local Computer and click on "Finish”
Click on “OK” to view the certificates in the local computer
The certificate store is then open